Privacy Policy

1. About this policy

FieldXM, Inc. ("FieldXM", "we", "us", "our") is a Delaware C corporation based in the United States. We are building a revenue-orchestration platform for in-person go-to-market. This policy explains how we handle personal information in connection with our website at https://www.fieldxm.com (the "Site"). The Site is a marketing and waitlist site where prospective design partners can request an invitation.

This policy covers people who visit the Site and people who submit our request-an-invitation form. In plain terms: for that information, FieldXM is the controller. When the FieldXM product becomes available and a customer uses it, FieldXM will generally act as a processor for the personal data that customer puts into the product about its own contacts and leads; that arrangement is described in Section 9.

Please read this policy to understand how we handle personal information. If you do not agree with it, please do not use the Site or submit the form. Your use of the Site is also governed by our Terms of Use.

2. Information we collect

We collect a defined set of information, described below by category.

Information you give us through the request-an-invitation form. The Site has one voluntary form. Its fields are:

• First name (required)
• Last name (required)
• Work email (required)
• Phone (required)
• Role or job title (required)
• Events per year: a selection from a fixed set of ranges (required)

The form includes this consent line: "By submitting this form, you opt in to receiving messages from FieldXM."

Completing the form is entirely voluntary. The required fields are needed only so we can identify you and respond to your request. If you choose not to provide them, we will not be able to process your invitation request, but this has no other consequence for you.

How your submission reaches us. The form is submitted to FieldXM through our own server endpoint, run by our hosting provider, which forwards your details to HubSpot Forms (HubSpot, Inc.), our customer-relationship-management provider. HubSpot, Inc. is based in the United States, so your form data is transferred to the United States under appropriate safeguards as described in Section 7. If the submission cannot be completed, the form shows an error with our email address so you can send the same details to hello@fieldxm.com. Neither step sets cookies in your browser.

Technical data recorded automatically by our hosting provider. Like essentially all web hosting, our static hosting and content-delivery-network (CDN) provider may automatically record standard technical request data in its server logs, for example, your IP address, your browser or user-agent string, a timestamp, and the URL requested. This is kept for security, fraud prevention, and reliability. We do not use these logs for advertising or cross-site tracking.

How we collect it. We collect personal information directly from you, when you choose to fill in and submit the form, and automatically, through the technical server logs described above. We do not buy personal data from data brokers.

3. How we use your information

We use the information described above only for these purposes:

• To respond to your request for an invitation and to communicate with you about it.
• To send you messages from FieldXM about our product and the design-partner program, where you have opted in.
• To evaluate and arrange potential design-partner participation, including the steps leading up to any agreement.
• To operate, secure, and maintain the reliability of the Site, including preventing fraud and abuse.
• To comply with our legal obligations and to establish, exercise, or defend legal claims.

We do not use your personal information for solely automated decision-making that produces legal or similarly significant effects about you.

Legal bases (EEA and UK). If you are in the European Economic Area (EEA) or the United Kingdom (UK), we rely on the following legal bases under the GDPR:

• Consent: for sending you marketing messages from FieldXM. You can withdraw your consent at any time, without affecting messages already sent.
• Legitimate interests: for responding to your inquiry, communicating with you about it, and keeping the Site secure and reliable. Our interest is in operating a safe site and following up with people who contact us, balanced against your rights.
• Steps toward a contract: for assessing and arranging design-partner onboarding at your request, before entering into any agreement.
• Legal obligation and legal claims: for complying with laws that apply to us, and for establishing, exercising, or defending legal claims, which is in our legitimate interests.

4. How we share and disclose information

We do not sell your personal information, and we share it only in the limited circumstances below.

Service providers, under contract. We use a small number of providers that handle information on our behalf and only on our instructions:

• HubSpot, Inc.: HubSpot Forms receives the details you submit (forwarded by our server endpoint), and we use HubSpot as our customer-relationship-management (CRM) tool to manage and respond to inquiries. HubSpot is based in the United States; your form data is transferred to the United States under the safeguards described in Section 7. If the submission cannot be completed, no data reaches HubSpot, and you can email the same details to us directly at hello@fieldxm.com.
• Our hosting / CDN provider: serves the Site, runs the serverless function that receives your form submission and forwards it to HubSpot, and maintains the technical server logs described in Section 2.

Legal and safety disclosures. We may disclose information if we believe in good faith that doing so is necessary to comply with a law, regulation, legal process, or governmental request; to enforce our agreements; or to protect the rights, property, or safety of FieldXM, our users, or others.

Business transfers. If FieldXM is involved in a merger, acquisition, financing, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will require that it remain subject to protections consistent with this policy.

We do not sell or share for advertising. We do not "sell" personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined under California law. We have not done so in the preceding 12 months. We run no advertising, no behavioral ad targeting, and no audience-building.

5. Cookies and tracking technologies

The Site uses no non-essential cookies (no analytics, tag manager, advertising or social-media pixels, session-replay, A/B-testing tools, or other third-party trackers) and currently sets no cookies that require your consent, so there is no cookie-consent banner to show you.

The form submits to HubSpot with the browser's credentials omitted, so that call sets no cookies; if the form falls back to your own email application instead, there is no third-party call at all.

The web fonts used on the Site (Instrument Sans and JetBrains Mono) are self-hosted. We make no calls to Google Fonts or any other font CDN, so loading the Site does not send a third-party font request.

6. Data retention and security

Retention. We keep the information you submit through the form for as long as we reasonably need it to respond to and evaluate your inquiry and to maintain our relationship with you. Where there is no active relationship and no legal reason to keep it, we aim to delete or anonymize inquiry data within 24 months of your last contact with us, or sooner on request. Technical server logs are retained by our hosting provider only for as long as needed for security and reliability (typically a short rolling window of days to a few weeks) and are then deleted in the ordinary course.

Security. We take reasonable technical and organizational measures to protect personal information, including encryption in transit (TLS), access controls that limit who can see your information, and the use of reputable service providers. No method of transmission or storage is 100% secure, however, and we cannot guarantee absolute security.

7. International data transfers

FieldXM is based in the United States, and the information we collect is processed in the United States by us and our service providers. If you are in the EEA or the UK, your personal information may be transferred to, and processed in, the United States, including, where the HubSpot form is enabled, the form data you submit, which is transferred to HubSpot, Inc. in the United States.

Where we transfer EEA or UK personal data to the United States, we do so using appropriate safeguards, such as the European Union and UK Standard Contractual Clauses. To request more information about these safeguards, or a copy of the relevant mechanism, contact us at privacy@fieldxm.com.

8. Your privacy rights

Depending on where you live, you may have rights over your personal information. We honor the rights described below and will not discriminate against you for exercising them.

If you are in the EEA or the UK (GDPR)

You have the right to:

• Access: request confirmation of whether we process your personal data and a copy of it.
• Rectification (correction): have inaccurate or incomplete data corrected.
• Erasure (deletion): ask us to delete your personal data in certain circumstances.
• Restriction: ask us to limit how we process your data in certain circumstances.
• Portability: receive certain data in a structured, commonly used, machine-readable format.
• Objection: object to processing based on our legitimate interests.
• Withdraw consent: withdraw consent to marketing messages at any time, without affecting processing already carried out.
• Lodge a complaint: complain to your local supervisory authority (in the EEA, the authority in your country of residence or work; in the UK, the Information Commissioner's Office).

We do not use your personal information for solely automated decision-making, including profiling, that produces legal or similarly significant effects about you under Article 22 of the GDPR.

If you are a California resident (CCPA/CPRA)

Over the preceding 12 months, the categories of personal information we have collected are identifiers (such as name, work email, and phone number), professional or employment-related information (such as company and role or job title), and internet or other electronic network activity information (the technical server-log data described in Section 2).

The sources of this information are you directly (the form, whether delivered through HubSpot or through your own email application) and your device or browser automatically (server logs). We collect and use it for the business and commercial purposes described in Section 3 (responding to inquiries, sending opted-in messages, evaluating design-partner participation, and securing the Site), and we disclose it only to the service providers and in the situations described in Section 4. We retain each category of personal information for the periods described in Section 6 (Data retention and security).

In the preceding 12 months, we disclosed identifiers, professional or employment-related information, and internet or other electronic network activity information to the service providers identified in Section 4 for the business purposes described in Section 3. We did not sell or share any category of personal information.

We do not sell your personal information and do not share it for cross-context behavioral advertising. Because we do not sell or share personal information, we do not provide a "Do Not Sell or Share My Personal Information" link, and no such opt-out mechanism is required. We do not collect sensitive personal information; because we do not, the right to limit its use does not apply and we do not provide a "Limit the Use of My Sensitive Personal Information" link. As a California resident, you have the right to:

• Know and access the personal information we have collected about you.
• Delete the personal information we have collected from you.
• Correct inaccurate personal information we hold about you.
• Opt out of the sale or sharing of your personal information (not applicable here, because we do not sell or share it).
• Limit the use of sensitive personal information (not applicable here, because we do not collect any).
• Non-discrimination for exercising your rights.
• Use an authorized agent to submit a request on your behalf, subject to verification.

How to exercise your rights. To make any request, email us at privacy@fieldxm.com. To protect your information, we will take reasonable steps to verify your identity before acting (typically by confirming details associated with your inquiry), and we may decline a request we cannot reasonably verify. Where a request is made by an authorized agent, we may require proof of the agent's authorization to act on your behalf and may still verify your identity directly. We will respond within the timeframes required by applicable law.

9. Our role for customer data (the FieldXM product)

The FieldXM product is not yet generally available, and this Site does not process customer-uploaded data today. This section is forward-looking and describes how we will handle data once the product is available.

When you use the FieldXM product as a customer, you may input or generate personal data about your own contacts and leads. For that data, you (the customer) are the controller, and FieldXM will act as a processor, handling the data only on your documented instructions under a Data Processing Agreement (DPA). We will use providers in categories such as cloud infrastructure, data storage, and email delivery to run the product; a current sub-processor list and our DPA will be available on request from privacy@fieldxm.com.

10. Children's privacy

The Site and the FieldXM product are intended for business users and are not directed to children. We do not knowingly collect personal information from anyone under 16 in the EEA or the UK, or under 13 in the United States. If we learn that we have collected such information, we will delete it. If you believe a child has provided us with personal information, please contact us at privacy@fieldxm.com.

11. Third-party links

The Site may contain links to third-party websites or services that we do not operate. We are not responsible for the privacy practices or content of those sites. We encourage you to review the privacy policy of any third-party site you visit.

12. Changes to this policy

We may update this policy from time to time. When we do, we will revise the "last updated" date above. For material changes, we will take reasonable steps to notify you, such as posting a notice on the Site or contacting you directly where appropriate.

13. How to contact us

FieldXM, Inc. is a Delaware corporation based in the United States. For privacy questions or to exercise your rights, contact privacy@fieldxm.com. For general inquiries, contact hello@fieldxm.com.

If you are in the EEA or the UK and believe we have not resolved your concern, you also have the right to lodge a complaint with your local data protection supervisory authority.